3 MINUTE READ
Project safety
Understand the boundaries before you give an agent a task.
A worktree isolates changes
Each task has a separate checkout and branch. That keeps concurrent edits out of your main working directory. It does not restrict the filesystem, network, or process permissions of commands run by an agent.
Use repositories you trust. Review project scripts and instructions before starting work, especially in downloaded repositories.
Review commands and permissions
Review the plan's validation commands before approval. Install commands can run dependency lifecycle scripts. Read runtime permission requests and grant only what the task needs.
Avoid putting secrets in task prompts or artifact summaries. If a secret is accidentally sent to a provider, rotate it through that provider's credential management.
Keep merges deliberate
Before merging, inspect the diff and tests and keep the target checkout clean. Integration review checks the approved commit and base so stale approval cannot silently merge a changed result.
Discard a worktree through Loom after reviewing its contents. Back up work you want to keep before deletion. Uninstalling Loom intentionally keeps your branches and worktrees.